CVE-2026-84860

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

CVE-2026-84860 Scada-LTS DWR Authorization Bypass - Systemic

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...

PT-2026-93806

Name of the Vulnerable Software and Affected Versions ScadaLTS version 2.8.1-release-candidate build 0 Description An authorization bypass exists because Spring Security restricts DWR endpoints using URL path patterns, while DWR dispatches method calls based on the c0-scriptName and c0-methodName...

CVE-2026-84860: Authorization Bypass Through User-Controlled Key

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is s...